Annex A Organizational and People Controls Kit

Policy hierarchy, naming and ID scheme, approval levels, review cadence, exceptions route, acknowledgement, full policy index mapped to Annex A

Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics

Label texts and formats, handling matrix from create to destroy per class, e-mail and file label settings, auto-labelling, paper and media, TLP mapping

Approved channel register, channel rules per classification, encryption, transfer agreements, cross-border personal data, APIs, verbal and courier rules, prohibited channels

Cloud policy for A.5.23: shared responsibility, tiers, due diligence, contract terms, configuration, monitoring, exit, shadow IT, cloud register

Threat intelligence for A.5.7: strategic, tactical, operational levels, requirements, sources, lifecycle, prioritisation, TLP, actions, log, metrics

Project security checklist for A.5.8: security tiers, gates G1 to G4, checks per stage, privacy by design, project types (software, cloud, M&A), risk log

ICT continuity requirements from the BIA, RTO and RPO per service, measured capability and gaps, strategies, recovery order, test programme, size tiers

Review programme and triggers, reviewer independence, ISMS approach checklist, manager and technical compliance checklists, ratings, reporting, size tiers

Criteria for which activities need a procedure, procedure register, model SOP layout, writing rules, lifecycle, worked SOPs for access provisioning and backup verification

Staff AUP (DOC-ISMS-040): rules by channel, generative AI, BYOD, remote work, media, prohibited use, monitoring notice examples, acknowledgment, size tiers, records

Risk-based screening levels S1 to S3, role mapping, check catalogue, jurisdiction table, adverse findings, contractors, re-screening, retention

Confidentiality requirements analysis, five agreement variants, signing gate, register, review, model clauses incl. protected disclosures and return

Principles, breach categories C0 to C3, incident hand-off, investigation, fair process and appeal, outcomes and factors, contractors, records

Leaver types L1 to L5 with revocation timing, HR triggers, leaver and mover checklists, privileged and urgent leavers, continuing duties, verification

Remote working policy: eligibility levels, permitted devices, networks, home and travel rules, working abroad, monitoring transparency, lost-device reporting

Security event reporting: what to report, channels, timing, no-blame rule, triage and hand-off to incident response, reporter feedback, metrics, channel tests